Your booking is secure... but is your passport data?

Malaysia Airlines confirmed that some of its customers' data may have been compromised, noting that its internal systems remained secure and that no evidence of unauthorized access to financial information had been detected.

For its part, Amadeus explained that it had discovered a security vulnerability in a technical environment dedicated to displaying booking information, confirming that investigations are ongoing to determine the scope of the breach and the nature of the data that may have been affected.

This incident highlights a less visible aspect of travel security, as the risks of information leaks are not limited to the airlines themselves but extend to technology companies and third parties that handle passenger data.

Where is your data stored after booking a ticket?

The process of booking an airline ticket is not limited to dealing with the airline alone; the travel industry relies on a vast network of technical service providers who manage bookings, issue tickets, and handle check-ins, connecting airlines with travel agencies and airports.

Passenger information is typically stored in a record known as a "PNR," or Passenger Name Record, which includes data such as name, booking reference, flight times, and contact information.

Depending on the nature of the booking, these records may contain more sensitive information, including passport numbers, nationality, and frequent flyer program details.

Consequently, the access of these details to multiple parties increases the likelihood of them being compromised, especially if all parties do not adhere to strict data protection standards.

How can your leaked data be exploited?

Fraudsters do not necessarily need to obtain your bank card details to target you; simply knowing your name, booking reference, and flight date may give them enough information to draft fraudulent messages that appear to be from the airline.

These messages may include bogus requests to confirm a booking, pay additional fees, or update passport details, leveraging genuine details that make them more convincing to the traveler.

In the Amadeus incident, Japan Airlines revealed that the data of about 2,000 customers included additional information, including passport numbers and contact details.

Despite this, the affected companies confirmed there was no evidence of a payment information leak, and as of now, there is no proof that the affected data has been exploited for fraudulent operations.

Who bears the responsibility for protecting passenger data?

Airlines are responsible for ensuring the reliability of the technical service providers they work with and for monitoring how customer data is collected, stored, and processed.

Conversely, tech companies are responsible for securing their systems, limiting access privileges to information, and taking the necessary measures to prevent leaks.

As for legal liability and potential compensation, these vary depending on the nature of the incident, applicable laws, and the contracts governing the relationship between the parties.

How do you protect your data?

Travelers are advised not to interact with unexpected messages requesting booking modifications or additional fee payments, and to avoid clicking on links from unknown sources, while emphasizing the need to verify any request regarding personal information through the airline's official website or application.

The danger does not always lie in a breach of the airline you chose; it may come from one of the technical entities through which your data passes without your knowledge.